CVE-2026-49837
MEDIUMCVE-2026-49837 is a medium-severity (CVSS 5.9) remote code execution vulnerability in github.com/osrg/gobgp/v4. O3 Security confirms whether CVE-2026-49837 is actually reachable in your code before you act, and blocks exploitation at runtime until you patch.
GoBGP: BGP OPEN capability parser may read capability values outside declared CapLen boundaries
Real-World Exposure
github.com/osrg/gobgp/v4Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Go packages — download data is not available via public APIs for these ecosystems.
Description
Summary
GoBGP contains a BGP OPEN capability parsing issue where several concrete capability decoders may parse data from the full remaining capability buffer instead of the slice bounded by the declared capability length, `CapLen`.
A malformed BGP OPEN message can cause bytes from a following capability to be interpreted as part of the current capability. The most security-relevant case is the 4-octet AS capability, where a capability with `CapLen == 0` may cause the parser to read bytes from the following capability as the 4-octet AS value. This parsed value may later affect peer AS validation during BGP session establishment.
Details
The issue is in the BGP OPEN capability parser under:
pkg/packet/bgp/bgp.gopkg/packet/bgp/validate.go
The BGP OPEN optional parameter capability format includes a capability code, a capability length field, and a capability value. Each concrete capability decoder should only parse bytes inside the declared capability value boundary.
In affected versions, the generic capability parser records the declared CapLen, but several concrete capability decoders continue parsing from the full remaining capability buffer after advancing past the two-byte capability header. Conceptually, the vulnerable pattern is:
data = data[2:]
// decoder reads from data without first limiting it to CapLen
### PoC
The following parser-level proof of concept demonstrates the issue without requiring a full BGP session or a running `bgpd` instance.
The malformed capability uses:
- Capability Code: `65` (`BGP_CAP_FOUR_OCTET_AS_NUMBER`)
- Declared `CapLen`: `0`
- Four following bytes: `00 00 fd e8`
Although the capability declares an empty value, affected versions parse the following four bytes as the 4-octet AS value `65000`.
### Impact
A remote peer that can send a malformed BGP OPEN message to a GoBGP instance may cause capability values to be parsed from outside their declared `CapLen` boundaries.
In the 4-octet AS capability case, this may affect:
- peer AS validation;
- capability negotiation;
- interpretation of malformed OPEN messages;
- acceptance or rejection decisions during BGP session establishment.
This issue does not appear to be arbitrary memory corruption, remote code execution, or information disclosure. It is a protocol parser boundary validation issue that can affect BGP OPEN validation semantics.
Affected Packages
| Ecosystem | Package | Vulnerable range | Fix |
|---|---|---|---|
| 🐹Go | github.com/osrg/gobgp/v4 | all versions | 4.6.0 |
Detection & mitigation playbook
Open-source dependencyDetect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for github.com/osrg/gobgp/v4. O3's reachability analysis confirms whether the vulnerable code path is actually invoked in your application, so you act on real exposure instead of every transitive match.
Fix
Update github.com/osrg/gobgp/v4 to 4.6.0 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-49837 is resolved across your whole dependency graph.
Workarounds
If you can't upgrade right away: gate or disable the affected feature, validate untrusted input at the boundary, and avoid passing attacker-controlled data into the vulnerable path. O3's runtime protection blocks exploitation in production as an interim safeguard until the upgrade lands.
How O3 protects you
O3 pinpoints whether CVE-2026-49837 is reachable in your code and exactly where to fix it, then blocks exploitation in production at runtime until the patched version is deployed.
Tailored to CVE-2026-49837. Runtime protection reduces exposure until a permanent patch is applied and verified — it complements patching, it doesn't replace it.
Frequently Asked Questions
Is CVE-2026-49837 in your dependencies?
O3 detects CVE-2026-49837 across Go dependencies and uses function-level reachability to confirm whether the vulnerable code path is actually reachable — not just present. No false positives.